adb/daemon/auth.cpp - android_system_core - Gitiles

 /*
  * Copyright (C) 2012 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

 #define TRACE_TAG AUTH

 #include "adb.h"
 #include "adb_auth.h"
 #include "adb_io.h"
 #include "fdevent/fdevent.h"
 #include "sysdeps.h"
 #include "transport.h"

 #include <resolv.h>
 #include <stdio.h>
 #include <string.h>
 #include <iomanip>

 #include <algorithm>
 #include <memory>

 #include <android-base/file.h>
 #include <android-base/strings.h>
 #include <crypto_utils/android_pubkey.h>
 #include <openssl/obj_mac.h>
 #include <openssl/rsa.h>
 #include <openssl/sha.h>

 static fdevent* listener_fde = nullptr;
 static fdevent* framework_fde = nullptr;
 static auto& framework_mutex = *new std::mutex();
 static int framework_fd GUARDED_BY(framework_mutex) = -1;
 static auto& connected_keys GUARDED_BY(framework_mutex) = *new std::vector<std::string>;

 static void adb_disconnected(void* unused, atransport* t);
 static struct adisconnect adb_disconnect = {adb_disconnected, nullptr};
 static atransport* adb_transport;
 static bool needs_retry = false;

 bool auth_required = true;

 bool adbd_auth_verify(const char* token, size_t token_size, const std::string& sig,
                       std::string* auth_key) {
     static constexpr const char* key_paths[] = { "/adb_keys", "/data/misc/adb/adb_keys", nullptr };

     for (const auto& path : key_paths) {
         if (access(path, R_OK) == 0) {
             LOG(INFO) << "Loading keys from " << path;
             std::string content;
             if (!android::base::ReadFileToString(path, &content)) {
                 PLOG(ERROR) << "Couldn't read " << path;
                 continue;
             }

             for (const auto& line : android::base::Split(content, "\n")) {
                 if (line.empty()) continue;
                 *auth_key = line;
                 // TODO: do we really have to support both ' ' and '\t'?
                 char* sep = strpbrk(const_cast<char*>(line.c_str()), " \t");
                 if (sep) *sep = '\0';

                 // b64_pton requires one additional byte in the target buffer for
                 // decoding to succeed. See http://b/28035006 for details.
                 uint8_t keybuf[ANDROID_PUBKEY_ENCODED_SIZE + 1];
                 if (b64_pton(line.c_str(), keybuf, sizeof(keybuf)) != ANDROID_PUBKEY_ENCODED_SIZE) {
                     LOG(ERROR) << "Invalid base64 key " << line.c_str() << " in " << path;
                     continue;
                 }

                 RSA* key = nullptr;
                 if (!android_pubkey_decode(keybuf, ANDROID_PUBKEY_ENCODED_SIZE, &key)) {
                     LOG(ERROR) << "Failed to parse key " << line.c_str() << " in " << path;
                     continue;
                 }

                 bool verified =
                     (RSA_verify(NID_sha1, reinterpret_cast<const uint8_t*>(token), token_size,
                                 reinterpret_cast<const uint8_t*>(sig.c_str()), sig.size(),
                                 key) == 1);
                 RSA_free(key);
                 if (verified) return true;
             }
         }
     }
     auth_key->clear();
     return false;
 }

 static bool adbd_send_key_message_locked(std::string_view msg_type, std::string_view key)
         REQUIRES(framework_mutex) {
     if (framework_fd < 0) {
         LOG(ERROR) << "Client not connected to send msg_type " << msg_type;
         return false;
     }
     std::string msg = std::string(msg_type) + std::string(key);
     int msg_len = msg.length();
     if (msg_len >= static_cast<int>(MAX_FRAMEWORK_PAYLOAD)) {
         LOG(ERROR) << "Key too long (" << msg_len << ")";
         return false;
     }

     LOG(DEBUG) << "Sending '" << msg << "'";
     if (!WriteFdExactly(framework_fd, msg.c_str(), msg_len)) {
         PLOG(ERROR) << "Failed to write " << msg_type;
         return false;
     }
     return true;
 }

 static bool adbd_auth_generate_token(void* token, size_t token_size) {
     FILE* fp = fopen("/dev/urandom", "re");
     if (!fp) return false;
     bool okay = (fread(token, token_size, 1, fp) == 1);
     fclose(fp);
     return okay;
 }

 static void adb_disconnected(void* unused, atransport* t) {
     LOG(INFO) << "ADB disconnect";
     adb_transport = nullptr;
     needs_retry = false;
     {
         std::lock_guard<std::mutex> lock(framework_mutex);
         if (framework_fd >= 0) {
             adbd_send_key_message_locked("DC", t->auth_key);
         }
         connected_keys.erase(std::remove(connected_keys.begin(), connected_keys.end(), t->auth_key),
                              connected_keys.end());
     }
 }

 static void framework_disconnected() {
     LOG(INFO) << "Framework disconnect";
     if (framework_fde) {
         fdevent_destroy(framework_fde);
         {
             std::lock_guard<std::mutex> lock(framework_mutex);
             framework_fd = -1;
         }
     }
 }

 static void adbd_auth_event(int fd, unsigned events, void*) {
     if (events & FDE_READ) {
         char response[2];
         int ret = unix_read(fd, response, sizeof(response));
         if (ret <= 0) {
             framework_disconnected();
         } else if (ret == 2 && response[0] == 'O' && response[1] == 'K') {
             if (adb_transport) {
                 adbd_auth_verified(adb_transport);
             }
         }
     }
 }

 void adbd_auth_confirm_key(atransport* t) {
     if (!adb_transport) {
         adb_transport = t;
         t->AddDisconnect(&adb_disconnect);
     }

     {
         std::lock_guard<std::mutex> lock(framework_mutex);
         if (framework_fd < 0) {
             LOG(ERROR) << "Client not connected";
             needs_retry = true;
             return;
         }

         adbd_send_key_message_locked("PK", t->auth_key);
     }
 }

 static void adbd_auth_listener(int fd, unsigned events, void* data) {
     int s = adb_socket_accept(fd, nullptr, nullptr);
     if (s < 0) {
         PLOG(ERROR) << "Failed to accept";
         return;
     }

     {
         std::lock_guard<std::mutex> lock(framework_mutex);
         if (framework_fd >= 0) {
             LOG(WARNING) << "adb received framework auth socket connection again";
             framework_disconnected();
         }

         framework_fd = s;
         framework_fde = fdevent_create(framework_fd, adbd_auth_event, nullptr);
         fdevent_add(framework_fde, FDE_READ);

         if (needs_retry) {
             needs_retry = false;
             send_auth_request(adb_transport);
         }

         // if a client connected before the framework was available notify the framework of the
         // connected key now.
         if (!connected_keys.empty()) {
             for (const auto& key : connected_keys) {
                 adbd_send_key_message_locked("CK", key);
             }
         }
     }
 }

 void adbd_notify_framework_connected_key(atransport* t) {
     if (!adb_transport) {
         adb_transport = t;
         t->AddDisconnect(&adb_disconnect);
     }
     {
         std::lock_guard<std::mutex> lock(framework_mutex);
         if (std::find(connected_keys.begin(), connected_keys.end(), t->auth_key) ==
             connected_keys.end()) {
             connected_keys.push_back(t->auth_key);
         }
         if (framework_fd >= 0) {
             adbd_send_key_message_locked("CK", t->auth_key);
         }
     }
 }

 void adbd_cloexec_auth_socket() {
     int fd = android_get_control_socket("adbd");
     if (fd == -1) {
         PLOG(ERROR) << "Failed to get adbd socket";
         return;
     }
     fcntl(fd, F_SETFD, FD_CLOEXEC);
 }

 void adbd_auth_init(void) {
     int fd = android_get_control_socket("adbd");
     if (fd == -1) {
         PLOG(ERROR) << "Failed to get adbd socket";
         return;
     }

     if (listen(fd, 4) == -1) {
         PLOG(ERROR) << "Failed to listen on '" << fd << "'";
         return;
     }

     listener_fde = fdevent_create(fd, adbd_auth_listener, nullptr);
     fdevent_add(listener_fde, FDE_READ);
 }

 void send_auth_request(atransport* t) {
     LOG(INFO) << "Calling send_auth_request...";

     if (!adbd_auth_generate_token(t->token, sizeof(t->token))) {
         PLOG(ERROR) << "Error generating token";
         return;
     }

     apacket* p = get_apacket();
     p->msg.command = A_AUTH;
     p->msg.arg0 = ADB_AUTH_TOKEN;
     p->msg.data_length = sizeof(t->token);
     p->payload.assign(t->token, t->token + sizeof(t->token));
     send_packet(p, t);
 }

 void adbd_auth_verified(atransport* t) {
     LOG(INFO) << "adb client authorized";
     handle_online(t);
     send_connect(t);
 }
	/*
	* Copyright (C) 2012 The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	#define TRACE_TAG AUTH

	#include "adb.h"
	#include "adb_auth.h"
	#include "adb_io.h"
	#include "fdevent/fdevent.h"
	#include "sysdeps.h"
	#include "transport.h"

	#include <resolv.h>
	#include <stdio.h>
	#include <string.h>
	#include <iomanip>

	#include <algorithm>
	#include <memory>

	#include <android-base/file.h>
	#include <android-base/strings.h>
	#include <crypto_utils/android_pubkey.h>
	#include <openssl/obj_mac.h>
	#include <openssl/rsa.h>
	#include <openssl/sha.h>

	static fdevent* listener_fde = nullptr;
	static fdevent* framework_fde = nullptr;
	static auto& framework_mutex = *new std::mutex();
	static int framework_fd GUARDED_BY(framework_mutex) = -1;
	static auto& connected_keys GUARDED_BY(framework_mutex) = *new std::vector<std::string>;

	static void adb_disconnected(void* unused, atransport* t);
	static struct adisconnect adb_disconnect = {adb_disconnected, nullptr};
	static atransport* adb_transport;
	static bool needs_retry = false;

	bool auth_required = true;

	bool adbd_auth_verify(const char* token, size_t token_size, const std::string& sig,
	std::string* auth_key) {
	static constexpr const char* key_paths[] = { "/adb_keys", "/data/misc/adb/adb_keys", nullptr };

	for (const auto& path : key_paths) {
	if (access(path, R_OK) == 0) {
	LOG(INFO) << "Loading keys from " << path;
	std::string content;
	if (!android::base::ReadFileToString(path, &content)) {
	PLOG(ERROR) << "Couldn't read " << path;
	continue;
	}

	for (const auto& line : android::base::Split(content, "\n")) {
	if (line.empty()) continue;
	*auth_key = line;
	// TODO: do we really have to support both ' ' and '\t'?
	char* sep = strpbrk(const_cast<char*>(line.c_str()), " \t");
	if (sep) *sep = '\0';

	// b64_pton requires one additional byte in the target buffer for
	// decoding to succeed. See http://b/28035006 for details.
	uint8_t keybuf[ANDROID_PUBKEY_ENCODED_SIZE + 1];
	if (b64_pton(line.c_str(), keybuf, sizeof(keybuf)) != ANDROID_PUBKEY_ENCODED_SIZE) {
	LOG(ERROR) << "Invalid base64 key " << line.c_str() << " in " << path;
	continue;
	}

	RSA* key = nullptr;
	if (!android_pubkey_decode(keybuf, ANDROID_PUBKEY_ENCODED_SIZE, &key)) {
	LOG(ERROR) << "Failed to parse key " << line.c_str() << " in " << path;
	continue;
	}

	bool verified =
	(RSA_verify(NID_sha1, reinterpret_cast<const uint8_t*>(token), token_size,
	reinterpret_cast<const uint8_t*>(sig.c_str()), sig.size(),
	key) == 1);
	RSA_free(key);
	if (verified) return true;
	}
	}
	}
	auth_key->clear();
	return false;
	}

	static bool adbd_send_key_message_locked(std::string_view msg_type, std::string_view key)
	REQUIRES(framework_mutex) {
	if (framework_fd < 0) {
	LOG(ERROR) << "Client not connected to send msg_type " << msg_type;
	return false;
	}
	std::string msg = std::string(msg_type) + std::string(key);
	int msg_len = msg.length();
	if (msg_len >= static_cast<int>(MAX_FRAMEWORK_PAYLOAD)) {
	LOG(ERROR) << "Key too long (" << msg_len << ")";
	return false;
	}

	LOG(DEBUG) << "Sending '" << msg << "'";
	if (!WriteFdExactly(framework_fd, msg.c_str(), msg_len)) {
	PLOG(ERROR) << "Failed to write " << msg_type;
	return false;
	}
	return true;
	}

	static bool adbd_auth_generate_token(void* token, size_t token_size) {
	FILE* fp = fopen("/dev/urandom", "re");
	if (!fp) return false;
	bool okay = (fread(token, token_size, 1, fp) == 1);
	fclose(fp);
	return okay;
	}

	static void adb_disconnected(void* unused, atransport* t) {
	LOG(INFO) << "ADB disconnect";
	adb_transport = nullptr;
	needs_retry = false;
	{
	std::lock_guard<std::mutex> lock(framework_mutex);
	if (framework_fd >= 0) {
	adbd_send_key_message_locked("DC", t->auth_key);
	}
	connected_keys.erase(std::remove(connected_keys.begin(), connected_keys.end(), t->auth_key),
	connected_keys.end());
	}
	}

	static void framework_disconnected() {
	LOG(INFO) << "Framework disconnect";
	if (framework_fde) {
	fdevent_destroy(framework_fde);
	{
	std::lock_guard<std::mutex> lock(framework_mutex);
	framework_fd = -1;
	}
	}
	}

	static void adbd_auth_event(int fd, unsigned events, void*) {
	if (events & FDE_READ) {
	char response[2];
	int ret = unix_read(fd, response, sizeof(response));
	if (ret <= 0) {
	framework_disconnected();
	} else if (ret == 2 && response[0] == 'O' && response[1] == 'K') {
	if (adb_transport) {
	adbd_auth_verified(adb_transport);
	}
	}
	}
	}

	void adbd_auth_confirm_key(atransport* t) {
	if (!adb_transport) {
	adb_transport = t;
	t->AddDisconnect(&adb_disconnect);
	}

	{
	std::lock_guard<std::mutex> lock(framework_mutex);
	if (framework_fd < 0) {
	LOG(ERROR) << "Client not connected";
	needs_retry = true;
	return;
	}

	adbd_send_key_message_locked("PK", t->auth_key);
	}
	}

	static void adbd_auth_listener(int fd, unsigned events, void* data) {
	int s = adb_socket_accept(fd, nullptr, nullptr);
	if (s < 0) {
	PLOG(ERROR) << "Failed to accept";
	return;
	}

	{
	std::lock_guard<std::mutex> lock(framework_mutex);
	if (framework_fd >= 0) {
	LOG(WARNING) << "adb received framework auth socket connection again";
	framework_disconnected();
	}

	framework_fd = s;
	framework_fde = fdevent_create(framework_fd, adbd_auth_event, nullptr);
	fdevent_add(framework_fde, FDE_READ);

	if (needs_retry) {
	needs_retry = false;
	send_auth_request(adb_transport);
	}

	// if a client connected before the framework was available notify the framework of the
	// connected key now.
	if (!connected_keys.empty()) {
	for (const auto& key : connected_keys) {
	adbd_send_key_message_locked("CK", key);
	}
	}
	}
	}

	void adbd_notify_framework_connected_key(atransport* t) {
	if (!adb_transport) {
	adb_transport = t;
	t->AddDisconnect(&adb_disconnect);
	}
	{
	std::lock_guard<std::mutex> lock(framework_mutex);
	if (std::find(connected_keys.begin(), connected_keys.end(), t->auth_key) ==
	connected_keys.end()) {
	connected_keys.push_back(t->auth_key);
	}
	if (framework_fd >= 0) {
	adbd_send_key_message_locked("CK", t->auth_key);
	}
	}
	}

	void adbd_cloexec_auth_socket() {
	int fd = android_get_control_socket("adbd");
	if (fd == -1) {
	PLOG(ERROR) << "Failed to get adbd socket";
	return;
	}
	fcntl(fd, F_SETFD, FD_CLOEXEC);
	}

	void adbd_auth_init(void) {
	int fd = android_get_control_socket("adbd");
	if (fd == -1) {
	PLOG(ERROR) << "Failed to get adbd socket";
	return;
	}

	if (listen(fd, 4) == -1) {
	PLOG(ERROR) << "Failed to listen on '" << fd << "'";
	return;
	}

	listener_fde = fdevent_create(fd, adbd_auth_listener, nullptr);
	fdevent_add(listener_fde, FDE_READ);
	}

	void send_auth_request(atransport* t) {
	LOG(INFO) << "Calling send_auth_request...";

	if (!adbd_auth_generate_token(t->token, sizeof(t->token))) {
	PLOG(ERROR) << "Error generating token";
	return;
	}

	apacket* p = get_apacket();
	p->msg.command = A_AUTH;
	p->msg.arg0 = ADB_AUTH_TOKEN;
	p->msg.data_length = sizeof(t->token);
	p->payload.assign(t->token, t->token + sizeof(t->token));
	send_packet(p, t);
	}

	void adbd_auth_verified(atransport* t) {
	LOG(INFO) << "adb client authorized";
	handle_online(t);
	send_connect(t);
	}